Solved

I am prepping a new Fortigate 240 running 5.2.9 to be installed. I have two WAN links. One is primary incoming with public IP and outgoing web. The second is mostly for VOIP and redundancy. I setup a WLLB with the two interfaces. I am now trying to setup policies. I have 1-2 rules that I want to do source (IP / domain) filtering on with Virtual IP NAT to internal server from WAN1. In the address object setup you cannot choose interface wan-load-balance only wan1 / wan2 or any. I know the traffic will come in WAN1 since that is where public IP is. Then when I create policy I must choose incoming interface of wan-load-balance since wan1 / wan2 aren't available in drop down. When I do this however it removes the address I created for wan1 from the drop down list of source addresses? Since I am using WWLB with the two wan interfaces do I need to choose any as interface for address object? Is there something I am missing here? I just want to make sure I am load balancing outg

Hello there, I`ve upgraded our FGT60C from Firmware v5.2.7 to v5.2.8. Now in ssl-vpn-portal rdp-native doesn`t work anymore. There comes the message "Failed to launch rdp-native" Java is installed correct and works. SMB-access to shares works as well. Has anybody the same experience? Thanks for comments. Nik

Hi all We have a site with a FG 60D with a few FP221c'sThe FGT is running version 5.4.1 build 5447 Users are complaining that they are having intermittent wireless connectivity issues.They noted the following The wireless remains connected, but access to the internet and internal resources is lost and later returns. They verified that when connected to the wired network they are not having any issues.This could happen several times a week. Anyone experience this issue ? Thanksggntt

I have a vpn config with forticlient... days ago worked well but today not. I review the events in the fortinet but does not tell me much. When the client tries to connect it reaches 98% and closes the application can you help with any idea?attachment the print screen

Hi! I uninstall Forticlient 5.4 on Windows 8.1, during uninstall it notice what services are running and I need to restart my PC.After I accepted Forticlient uninstall correctly but after restart ALL my network devices failed to start (code 10). WTF?  

All: We are trying to get an estimate of daily syslog log volume in GB with all logging options enabled on the 3700D for roughly a 500mbps throughput.  Could someone give us a rough estimate?  We realize there are many variables but are just looking for an estimate to make a comparison. Thanks!

I am working with a new client who's user community is big. When I am try to generate log for 1 day the log report has only 10,000 entries in it. But it would definitely have more than that. Is there any way to increase it ?. It would be great if someone could help me on that. 

Just acquired a Fortigate 70D and setting it up for the first time. Have not configured anything as complicated or powerful as this firewall before. Tablo is a device for capturing over-the-air TV broadcasts and streaming them to your viewing devices. It requires some port forwarding when you want to reach the device from outside. Specifically, it requires port 21101->8887 and 21100->80. I have tried to configure this on our Fortigate 70D but the device still says it is not properly configured. Here are all the sections of the config that pertain to the Tablo device. Please help me find where I have done something incorrect (or made it more complicated than it needs to be)! config system dhcp server     edit 1         config reserved-address             edit 1                 set ip

Hello all,I have trouble with FC 5.4.0.0780 on Win 7. When I'm trying to connect to FG I'm getting the following warning, and it stuck at 40% :"Unable to establish the VPN connection. The VPN server may be unreachable. (-5)" Does anyone have the similar issue ? Thank you in advance.

Hello, I have a fortianalyzer on version 5.2.7. I'd like to see what the top services (https, smtp, ftp, etc) are every hour over the course of a day, and how much bandwidth each is using per hour. Is there a custom dataset, or might someone help me create one, which will allow me to view the top 5 or so applications / services in use broken down by bandwidth and hour of day?  Thanks for any help.

Hello all,I am running firmware 5.2.8 what the benefit and impact of enable "heuristic quarantine" in Antivirus profile?What do I need to do it? Thanks

Hey folks. Newbie here. I'm not a networking person (more software pm and technical sales), so please excuse my ignorance on the subject. Our IT consultancy says that we should considering purchasing new firewall appliances to replace our 60D models; the organization has grown over the past few years, but not astronomically. My understanding from networking friends is that problems are often more related to software license limits than CPU. Its justification is that mobile device traffic isn't being covered (they say our firewalls couldn't handle the extra coverage) and that we're 'on the edge' of normal operation. We see no evidence that they're operating "on the edge". What are the signs we should look for that will tell us we do need a new firewall and how can we monitor that and be alerted when it happens? Thank you. -d 

I manage 7 separate sites servicing around 10,000 users in total with internet services through WiFi enabled equipment using Fortinet and Fortigate devices at each site. 9,996 users seem quite happy with the service, but 4 of them have reported an error when connecting to what I assume is the Authenticator, as the error comes up with the captive portal login option - the error reads 'Error (EBNCaptivePortalHandler) Unknown Error' (screenshot attached). The users are able to 'OK' the error and login successfully. The devices are iOS 9 and 10 (happened on both versions) to this small user group. These users have logged in successfully at other sites, without the error, so its just on this one site that they get this error. I have raised this with the service provider (we pay for this internet/WiFi service to be installed and managed for us) but since it is not all users at all sites, they argue that it is a personal handset issue not a system/infrastructure issue. Any thoughts

Hello, a customer asked me if it is possible to block / deny senders which have numbers in their email adresses like (mike445@example.com) . is it possible to build like a regex for that? is it possible to say if Sender has more than 2 Numbers or more than 3 numbers in his email adress? Thank you very much

Our new Fortimail appliance (400) refuses the typical https://192.168.0.99 admin login on port 1 SSH admin works fine. We have tried all major web browsers.We executed a factory reset.Yes, password is blank.Yes, "admin" Any suggestions????  

Hello, Is anyone running 0.0.0.0/0.0.0.0 as the source and destination for a P2 selector? I have a growing list of about 30 P2's that would be much easier to manage if it were just the one wildcard entry. I would still be controlling the traffic on my policies. Any pros/cons to doing it this way? The unit on the other side of the tunnel is a Fortigate as well.   Thanks

Hello everyone, I'm a newcomer. I come from a sonicwall tz205! I'd need some tips for setting up a new fortigate 100d... :)I will explain briefly the situation. I always had a very simple network. Now at work I have created a new network for voip phones. At the moment so I have two physical networks. 1 for PC in 192.168.1.0/24 2 for voip phone 192.168.3.0/24 I had the interfaces on sonicwall x0 x1 x2 ... on the new fortigate 100d I do not have that kind of division.I currently have 16 port switch hardware dedicated to the "LAN" with the address 192.168.1.0/24. How can I bind a port for the VoIP network? I neet to create a new interface ? zone ? vlan ? The other thing that I must say is that I wish the two networks were able to communicate.I did several tests but I can not do a ping from one network to another. Thank you all!

The fortigate 5.x documentation states that when you create a virtual IP address (VIP) and do NOT specify port mapping, that traffic should be translated for both inbound (dnat) and outbound (snat) traffic. If says: " if you leave the ' port forwarding' checkbox unchecked it is therefore mapping all ports, it will do bi-directional NAting, so the single VIP entry will control both inbound and outbound address translation." Overall this seems like a very good thing for reducing the complexity of configuration for standard internet-accessible servers. However, we' re finding that this doesn' t seem to work unless you issue " set nat-source-vip enable" from the CLI for every VIP (it defaults to disable). By default, outbound traffic just falls through to the general nat pool that we have set up for all other clients. Is this the expected behavior? If so, I can' t see how the reference manual is correct. If this is needed, is there a way to change the

Hello, I would like to ask some advise and recommendations as well with our Site-to-Site IPSEC VPN.Below are the scenarios. Please refer on the attached diagram. We have an existing Site-to-Site IPSEC which is Site A going to Site C. Since we are expanding our site, we are creating a new site which is site B. The problem is, it has the same IP segment, 192.168.18.xx. [strike]Also, our main goal is to be able to communicate site A and site B without changing the IP Networks on both sites. Meaning, we will use 192.168.18.xxx on both sites. Is it possible?[/strike] Already achieved this goal. Next, let's say we were able to achieve our main goal above. [strike]Our next goal is to be able to communicate site B to site C without changing configurations on site A to site C which is our existing site-to-site IPSEC.[/strike] Mission complete. :D  Thank You.

Hello, I'm currently building a site-to-site IPSEC VPN but I would like to know if its possible to use a private IP (10.10.10.0/30) network. Below is my current configuration. Firewall A:Port 10: 10.10.10.1/32 Firewall B: Port 9: 10.10.10.2/32 Both port interface is connected using a cross-cable. Problem: I tried to create an IPSEC - Phase 1 but the tunnel is still down. Thank You

I'm pretty new to setting firewall policies and I'm not sure if I'm looking in the right places to solve this problem. I have the below configs in my Fortigate 90D. For policy 6 I defined a group of schedules to cover all after-hour periods. However no one can access the internet on weekends. They can ping as far as the firewall, but not any external addresses. My question is, did I set the schedules correctly? Everything else appears to work fine, including "morning hours" and "evening hours". # show firewall policyconfig firewall policy    edit 1        set srcintf "internal"        set dstintf "wan"        set srcaddr "all"        set dstaddr "all"        set action accept        set schedule "working hours"        set ser

Hello everyone, i want to allow access to only one facebook page and block other pages...i've been looking for a solution but nothing worked, is there any way that i can do this. Im using URL filter.Fortigat 80D v5.2.7,build718 (GA) thank you for your answers 

Hi, I have a VPN between 2 Fortigate and I notice a strange behaviour : Some machines on one network can ping machines on the other side of the VPN while others can't.Checking in Fortiview / sessions, I discovered that some of them correctly execute the ping through the VPN while the other are trying to connect through WAN (and so it doesn't work). I configured policies for traffic going from and to the other side of VPN, and route to remote network using the corresponding vpn interface. In attachment is an example of what happens. My local network is 10.1.0.0/16 and the remote network is 192.168.0.0/16. Do you have any idea on how to solve this problem ? THank you very much, Regards, Fred

Hi all,I have a Fortigate 90D with Web filter and SSL Inspection enabled. I can't reach https://www.giustizia.it: with Chrome I receive "ERR_CONNECTION_CLOSED", with Firefox instead "Cannot create secure connection". If I turn off SSL Inspection I can navigate to the site; I have tried to add an exception in web filter's rules (wildcard, simple, exempt, allow...) but with no luck. How I can solve this issue?Thanks in advance

Anybody seen any cool tools that will grab fwpolicies and dump them into a format to import into xls, or csv or any other method?